Johnson Controls $5M Cybersecurity Settlement: What Contractors Must Know
Johnson Controls will pay $5 million to settle Justice Department claims it missed cybersecurity rules on federal contracts with NASA and the Pentagon.
Image: Wikimedia Commons / Jack E. Boucher
WASHINGTON, Nov. 15, 2026 — Johnson Controls Inc. and two of its subsidiaries have agreed to pay $5 million to resolve allegations that they failed to meet cybersecurity requirements in federal contracts, the United States Department of Justice announced on Friday. The settlement covers building products and services, including heating, ventilation and air conditioning work, supplied to NASA and the Departments of Defense, Energy and Justice between January 2018 and August 2025.
The agreement resolves claims brought under the False Claims Act. The Justice Department said the claims are allegations only and that no determination of liability has been made. The Milwaukee-based company did not admit wrongdoing as part of the settlement.
Key Takeaways
- Johnson Controls agreed to pay $5 million to resolve False Claims Act allegations over cybersecurity failures in federal contracts from January 2018 to August 2025.
- The contracts involved NASA and the Departments of Defense, Energy and Justice; some required NIST SP 800-171 cybersecurity controls.
- Whistleblower Kelly Vance, a former employee, will receive $850,000 of the settlement.
- The Justice Department stressed the resolved claims are allegations only and that no determination of liability has been made.
What Johnson Controls Allegedly Failed to Do Under Federal Cybersecurity Rules
According to the Justice Department, Johnson Controls entered into contracts and subcontracts that required it to put security controls in place to protect government information. Defense contracts required the cybersecurity controls in National Institute of Standards and Technology Special Publication 800-171, the standard for protecting controlled unclassified information in nonfederal systems. The government alleged the company failed to maintain a system security plan that met those requirements and failed to implement the controls the contracts required. Acting Assistant Attorney General Jonathan Guynn of the Justice Department's Civil Division said federal contractors must follow required cybersecurity standards.
| Settlement detail | Figure |
|---|---|
| Total settlement | $5 million |
| Period covered | January 2018 to August 2025 |
| Agencies involved | NASA; Departments of Defense, Energy and Justice |
| Whistleblower share | $850,000 to Kelly Vance |
| Liability finding | None — allegations only |
How the $5 Million Johnson Controls Settlement Affects Federal Contractors
The settlement is the latest in a series of Justice Department actions targeting cybersecurity compliance among federal contractors. The department's Civil Division has made clear that companies supplying the government must meet the security standards written into their contracts, and that whistleblowers who report failures can share in any recovery. For contractors, the case is a reminder that cybersecurity obligations in federal contracts are enforceable through the False Claims Act, even for routine building-services work.
Who Gets Paid in the Johnson Controls Whistleblower Settlement
The settlement resolves two whistleblower lawsuits filed under the False Claims Act, which allows private citizens to sue on behalf of the government and share in any recovery. Kelly Vance, a former Johnson Controls employee, filed his case in the Northern District of Georgia in June 2024 and will receive $850,000 as his share of the settlement. A second case was filed by David Thomas in the District of Columbia in February 2026. The investigation involved the Justice Department's Civil Division, two United States attorneys' offices and several federal investigative agencies. For further context on how the Justice Department pursues federal enforcement cases, see the department's probe into alleged chip smuggling and antitrust issues and its charges against three people over an alleged Iran-backed plot in Britain.
Frequently Asked Questions
Did Johnson Controls admit wrongdoing in the $5 million settlement?
No. The Justice Department said the resolved claims are allegations only, with no determination of liability and no court finding that the company violated the law.
What is NIST SP 800-171 and why does it matter for federal contractors?
NIST Special Publication 800-171 sets out security requirements for protecting controlled unclassified information in nonfederal systems. Defense contracts require those controls, and failure to meet them can bring False Claims Act liability.
How much will whistleblower Kelly Vance receive from the settlement?
Kelly Vance, a former Johnson Controls employee who sued in June 2024, will receive $850,000 of the $5 million settlement under the False Claims Act.
Which federal agencies had contracts with Johnson Controls in this case?
They involved NASA and the Departments of Defense, Energy and Justice, covering building products and services including heating, ventilation and air conditioning work from January 2018 to August 2025.
The full settlement agreement is published on the Justice Department's website. The announcement is available at justice.gov, with the agreement itself at justice.gov.
